Description
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Atlassian | Jira Service Desk Server | unspecified – < 4.13.9, 4.14.0 – < unspecified, unspecified – < 4.18.0 | 4.13.9 |
| Atlassian | Jira Service Desk Data Center | unspecified – < 4.13.9, 4.14.0 – < unspecified, unspecified – < 4.18.0 | 4.13.9 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
PetrusViet/CVE-2021-39115 ★ 48 · Sep 7, 2021
Template Injection in Email Templates leads to code execution on Jira Service Management Server
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.